grpVol Privacy Policy

Last updated: 21 October 2026

This policy explains what personal data grpVol collects through this website, why, who it is shared with, how long it is kept and what you can ask us to do with it.

1. Who we are

The controller of your personal data is [OWNER TO CONFIRM: legal entity name], registration number [OWNER TO CONFIRM: registration number], registered at [OWNER TO CONFIRM: registered address]. The grpVol Terms of Sale are governed by the laws of Singapore.

General contact: hello@grpvol.com. Data protection contact: [OWNER TO CONFIRM: data protection contact name and email].

2. What we collect

Account details: your email address, your full name and your confirmation that you are 18 or older, collected when you create an account.
TradingView username: collected after purchase so we can grant invite-only access to the indicator.
Legal acceptance records: when you sign the Terms of Sale, Terms of Service, Risk Disclosure and this Privacy Policy, we record the document versions and their fingerprints (SHA-256), the time, the full name you typed, the confirmation text you typed, the confirmations you ticked, your IP address and your browser user agent.
Order details from Shopify: order number, email, amount, currency and payment status. We do not receive or store card details. Payment is handled by Shopify.
Course progress: lessons opened, quiz attempts and scores, task progress and level status.
Trading journal: the session logs you enter (date, symbol, day type, zone, grade, outcome, notes) and any screenshots you upload.
Cookies: the sign-in cookies described in the Cookie Notice.

3. Why we use it, and on what basis

To create and run your account and deliver what you bought (account details, TradingView username, order details, course progress, journal). Basis: performance of our contract with you.
To keep evidence that you read and accepted the terms before paying, including your IP address and user agent at that moment, so we can show when and from where the agreement was made if a dispute or chargeback arises. Basis: our legitimate interest in defending legal claims, and compliance with legal obligations where they apply.
To send service emails such as your agreement copy and access confirmation. Basis: performance of our contract with you.
To keep the service secure, for example by limiting repeated sign-in attempts. Basis: our legitimate interest in protecting the service.

We do not sell your personal data. We do not use it for advertising.

4. Who we share it with

We use service providers who process data on our behalf:

Supabase: account sign-in, database and file storage.
Shopify: checkout and payment.
[OWNER TO CONFIRM: hosting provider, for example Vercel]: hosts this website.
Resend: sends service emails, only if email sending is enabled.
TradingView: receives your TradingView username when we grant you access to the indicator.

We may also disclose data where the law requires it or to establish, exercise or defend legal claims.

5. How long we keep it

Legal acceptance records and order records: for the life of your licence plus [OWNER TO CONFIRM: N] years, so we can defend disputes and chargebacks.
Course progress, journal entries and screenshots: until your account is deleted.
Account details and TradingView username: until your account is deleted, except where they are part of a legal acceptance or order record above.

6. International transfers

Our service providers may process data outside the country where you live. [OWNER TO CONFIRM: regions where Supabase, Shopify and the host store data, and the safeguards relied on for transfers.]

7. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you;
correct data that is wrong;
ask us to delete your data;
receive your data in a portable format;
object to processing based on legitimate interests;
withdraw consent where we rely on consent;
complain to the data protection authority where you live or where we are established.

8. How to exercise your rights

Use the "Request account deletion" button in your dashboard settings, or email hello@grpvol.com from the address on your account. Your journal can be exported as a CSV file from the dashboard at any time. We will answer within [OWNER TO CONFIRM: response time, for example 30 days]. Deleting your account removes your progress, journal and screenshots, but legal acceptance and order records are kept for the period in section 5.

9. Children

grpVol is for people aged 18 or older. If we learn that an account belongs to someone under 18, we delete the account.

10. Security

Course files and screenshots are stored in private storage and served through short-lived links. Access to your records is limited to you and to grpVol administrators.

11. Changes to this policy

When this policy changes we publish a new version with a new date. If the change affects what you agreed to, we will ask you to read and accept the new version before you continue using the member area.